riskrails 3.0.0 → 3.0.1

package/agents/ai-reviewer.md.tmpl

@@ -47,12 +47,14 @@ does each named finding close against the real code, and what did the remediatio
 introduce? A re-review that re-reads the whole change is a first review wearing
 the wrong name, and costs the same.
 
-Verify by execution where execution is possible. A claim you ran beats a claim you
-reasoned to, and it is what makes your row in the ledger worth inheriting.
+Read the diff; run only the tests the step names, through `step_test_command`; no
+scripts, mutation or timing loops in a scratchpad or temp dir. About 40 tool calls
+in light and guarded, about 80 in full, then FINDINGS and VERDICT, with
+`not reached (budget): …` under EXAMINED AND CLEAN.
 
 ## Boundary
 
-The brief names the task's mode; `.ai/state/current.json` has it otherwise. In
+The brief names the task's mode; `.ai/state/state.json` (or the legacy `current.json`) has it otherwise. In
 light and guarded mode your inputs are the task goal, the diff, the tests the
 step names, and the project's own fixture corpus and threat model:
 `.ai/policies/safety.md`, the guards' `*-defaults.json`, the test fixtures.
@@ -61,7 +63,7 @@ it — a shape no session produces, a size no fixture reaches — is reported as
 `[INFO]` with `in_scope: no`, with the severity it would carry inside the
 boundary in `why it matters`. It goes to the risk register, never to a
 remediation, and it does not move your verdict. In full mode there is no
-boundary: the list below applies unbounded.
+boundary: the list below applies unbounded, but the call cap holds.
 
 ## Look for
 

package/ai/policies/review-economy.md

@@ -91,7 +91,11 @@ A task gets **two passes**: one full review and one scoped re-review, at every
 tier. That holds whoever asks — a re-review the human requests is one of the
 two, a cross-vendor review is one, and the parallel dimensions of §4 together
 are one. When both are spent, a third pass is not the next move: the human
-decides the verdict. The reviewer's verdict says which closing rule applies:
+decides the verdict. One exception, chosen per project or per task: a **batch**
+task (`/rr-build-all`, `weight.json` `batch.*`) runs a whole plan as one task,
+and its passes are full ones — `batch.review_rounds_max` of them (three as
+shipped), each after a fix batch — before the same stop: the pass past that
+number is the human's. The reviewer's verdict says which closing rule applies:
 `blockers_open` (a BLOCKER) takes the remediation and the scoped re-review;
 `pass_with_findings` (a HIGH, no BLOCKER) takes the remediation and a green
 verification run, no re-review; `pass` closes. `state.py` has no value of its
@@ -204,6 +208,7 @@ work.
 - No reviewer is moved to a cheaper model to go faster. Narrow the surface, never
   the mind.
 - A blocker still returns to implementation, however late it arrives. Past the
-  two passes of §3, a human — not a third pass — decides that it closed.
+  two passes of §3 — `batch.review_rounds_max` passes in a batch task — a human,
+  not another pass, decides that it closed.
 - The probe is the manager's own work and never replaces the adversarial pass. It
   exists so the pass starts further in, not so it happens less.

package/ai/using-riskrails.md

@@ -13,6 +13,7 @@ the steps; `policies/` holds the rules; this says which to open.
 | turn an idea into intent, requirements and design | `/rr-spec <idea>` |
 | plan a spec into tasks, or one task into a mode and a start | `/rr-plan <spec or task>` |
 | do the work, or resume it | `/rr-build` (no task in flight: it runs `/rr-plan` first) |
+| run a whole plan as one task — parallel implementers and fixers, tests and the review again until it passes | `/rr-build-all <plan>` |
 | review the change | `/rr-review` — guarded and full, or when `close` asks |
 | close the task, get the human's approval | `/rr-ship` |
 | see where the task stands, or what it cost | `/rr-status`, `/rr-status --cost` |
@@ -38,6 +39,20 @@ domain at 2 is full whatever W is.
 The mode only rises during a task (`verify` and `close` re-score reversibility
 and domain from the diff); lowering it is the human's.
 
+## Batch — one task for a whole plan
+
+`/rr-build-all docs/sdlc/plans/<slug>.md` runs every row of a programme plan as
+one task: the ready rows go to parallel implementers on BALANCED (`after`
+serializes the dependent ones), the suite runs once, every failure is fixed by
+parallel fixers as one batch, one review at the mode's tier, its findings fixed
+as one batch, then tests and the review again until it passes. Its budgets are
+`weight.json` `batch.*`: three failed review passes (`batch.review_rounds_max`)
+and eight suite runs stop at the human — `REVIEW_BUDGET` and `SUITE_BUDGET`, as
+always. The mode, the guard, the two facts and the gate are unchanged.
+`batch.default` makes it the project's default; `state.py batch off --by …
+--why …` returns a task to the standard loop (anyone); `batch on` mid-task is
+the human's, from their own terminal.
+
 ## The two facts
 
 `close` measures, never asks: (a) a green whole-suite `verify` on the tree as it

package/bin/claude-1m

@@ -6,15 +6,15 @@
 #   claude-1m                    Opus 5 [1m] as the main session
 #   claude-1m fable              Fable 5.1 [1m] as the main session
 #   claude-1m fable -p '<brief>' one headless large-context run, e.g. called from another session
-#   CLAUDE_1M_COMPACT_WINDOW=500000 claude-1m     # compact earlier than 767k
+#   CLAUDE_1M_COMPACT_WINDOW=500000 claude-1m     # compact earlier than the runtime would
 #
-# `autoCompactWindow` in settings.json is one value for every model, but Claude Code
-# caps it at the model's own window, so the 800 000 there already means near 167k on
-# `opus` and near 767k on `opus[1m]` and `fable[1m]`. This launcher is therefore about
-# the model, not the window: it pins a [1m] model for one session at launch.
-# CLAUDE_CODE_AUTO_COMPACT_WINDOW still outranks settings.json for this process only,
-# which is how CLAUDE_1M_COMPACT_WINDOW compacts *earlier* than 767k. context-guard
-# reads the same variable, so its warning and hold-back thresholds follow.
+# This launcher is about the model, not the window: it pins a [1m] model for one
+# session at launch, and by default leaves compaction to Claude Code (or to the
+# `autoCompactWindow` of an install with `--context economy`, which Claude Code caps at
+# the model's own window: 800 000 means near 167k on `opus` and near 767k on `opus[1m]`).
+# Only CLAUDE_1M_COMPACT_WINDOW sets a window: exported as CLAUDE_CODE_AUTO_COMPACT_WINDOW,
+# it outranks settings.json for this process only. context-guard reads the same
+# variable, so its warning and hold-back thresholds follow.
 #
 # Subagents get the session's window, capped by Claude Code at each model's own: a 200k
 # agent compacts near 167k, and `architect` on fable[1m] gets the full window.
@@ -28,10 +28,11 @@ case "${1:-}" in
   fable) MODEL='fable[1m]'; shift;;
 esac
 
-WINDOW="${CLAUDE_1M_COMPACT_WINDOW:-800000}"
-case "$WINDOW" in
-  ''|*[!0-9]*) echo "claude-1m: CLAUDE_1M_COMPACT_WINDOW must be a number of tokens (got '$WINDOW')" >&2; exit 2;;
-esac
-
-export CLAUDE_CODE_AUTO_COMPACT_WINDOW="$WINDOW"
+if [ -n "${CLAUDE_1M_COMPACT_WINDOW:-}" ]; then
+  WINDOW="$CLAUDE_1M_COMPACT_WINDOW"
+  case "$WINDOW" in
+    ''|*[!0-9]*) echo "claude-1m: CLAUDE_1M_COMPACT_WINDOW must be a number of tokens (got '$WINDOW')" >&2; exit 2;;
+  esac
+  export CLAUDE_CODE_AUTO_COMPACT_WINDOW="$WINDOW"
+fi
 exec "${CLAUDE_BIN:-claude}" --model "$MODEL" "$@"

package/bin/riskrails.js

@@ -2,6 +2,7 @@
 // RiskRails installer (Claude Code and/or Codex). Node 18+, stdlib only.
 //   npx riskrails [--target auto|claude|codex|both] [--plan pro|team-pro|team-max|max|max20|balanced-max]
 //                 [--fable auto|yes|no] [--codex-plan plus|pro|balanced-max] [--dry-run]
+//                 [--context default|economy] [--statusline-context yes|no]
 //                 [--home DIR] [--codex-home DIR] [--yes] [--version]
 // --target defaults to auto: each runtime is installed only if its executable is on PATH.
 // --plan   Claude only: pro, team-pro (Team Standard seat), team-max (Team Premium seat), max
@@ -16,6 +17,14 @@
 // --fable  Claude only. auto = yes on max, max20 and team-max, no on pro and team-pro.
 // --codex-plan  Codex only: plus, pro or balanced-max. Defaults to auto-detect from the ChatGPT
 //          login in ~/.codex/auth.json (chatgpt_plan_type); assumes pro when it cannot tell.
+// --context  default leaves each runtime its own context window and compaction, and
+//          context-guard only warns. economy writes the plan's autoCompactWindow (800 000 on
+//          Max, 300 000 on Pro) and the guard also holds a prompt back past 120% of it.
+//          Without economy, an autoCompactWindow equal to the plan's is removed; any other
+//          value is the user's and stays. Recorded in riskrails/profile.json as `context`.
+// --statusline-context  yes (default) shows the model and the context use in the
+//          statusline: a line before the user's own in Claude Code, `model-with-reasoning`
+//          and `context-used` in Codex's [tui] status_line. no adds nothing and removes nothing.
 // --home / --codex-home  the runtime homes (default ~/.claude and ~/.codex; the environment
 //          variables CLAUDE_DIR and CODEX_DIR mean the same). Naming exactly one of them under
 //          --target auto installs that runtime alone.
@@ -47,6 +56,7 @@ let CODEX_DIR = env.CODEX_DIR || path.join(os.homedir(), '.codex');
 const HOME = env.HOME || os.homedir();
 let PLAN = '', FABLE = 'auto', DRY = false, TARGET = 'auto', PLAN_GIVEN = false;
 let CODEX_PLAN = '', CODEX_PLAN_GIVEN = false, YES = false;
+let CONTEXT = 'default', STATUSLINE_CONTEXT = 'yes';
 
 function version() {
   try { return JSON.parse(fs.readFileSync(path.join(SRC, 'package.json'), 'utf8')).version || 'unknown'; }
@@ -76,6 +86,8 @@ function usage() {
       case '--plan': PLAN = take(); PLAN_GIVEN = true; break;
       case '--fable': FABLE = take(); PLAN_GIVEN = true; break;
       case '--codex-plan': CODEX_PLAN = take(); CODEX_PLAN_GIVEN = true; break;
+      case '--context': CONTEXT = take(); break;
+      case '--statusline-context': STATUSLINE_CONTEXT = take(); break;
       case '--home': CLAUDE_DIR = path.resolve(take()); CLAUDE_DIR_GIVEN = true; break;
       case '--codex-home': CODEX_DIR = path.resolve(take()); CODEX_DIR_GIVEN = true; break;
       case '--dry-run': DRY = true; break;
@@ -89,6 +101,10 @@ function usage() {
 if (!['auto', 'claude', 'codex', 'both'].includes(TARGET)) {
   die(`--target must be auto|claude|codex|both (got '${TARGET}')`, 2);
 }
+if (!['default', 'economy'].includes(CONTEXT)) die(`--context must be default|economy (got '${CONTEXT}')`, 2);
+if (!['yes', 'no'].includes(STATUSLINE_CONTEXT)) {
+  die(`--statusline-context must be yes|no (got '${STATUSLINE_CONTEXT}')`, 2);
+}
 const major = Number(process.versions.node.split('.')[0]);
 if (major < 18) die('riskrails needs Node 18 or newer (this is ' + process.versions.node + ')', 1);
 
@@ -281,7 +297,7 @@ let PLUGIN_VERSION = 'unknown';
 try { PLUGIN_VERSION = readJSON(path.join(SRC, '.codex-plugin/plugin.json')).version || 'unknown'; } catch (e) { /* unknown */ }
 function agenticProfile(runtime, profile, plan, label, fable) {
   const p = JSON.parse(python([path.join(SRC, 'scripts/resolve-profile.py'), profile, '--src', SRC, '--plan', plan,
-    '--label', label, '--fable', fable, '--print', 'agentic']));
+    '--label', label, '--fable', fable, '--context', CONTEXT, '--print', 'agentic']));
   p.runtime = runtime; p.plugin_version = PLUGIN_VERSION; p.written_at = utcStamp();
   p.dialog = { tool: runtime === 'claude' ? 'AskUserQuestion' : codexDialogTool() };
   p.set_by = { via: 'installer', at: p.written_at };
@@ -391,7 +407,9 @@ function claudeRender() {
 
   // The profile's riskrails tables are the plugin's, not Claude Code's: the resolver
   // prints the settings half alone, so they never reach settings.json.
-  const profile = JSON.parse(python([path.join(SRC, 'scripts/resolve-profile.py'), PROFILE_NAME, '--src', SRC, '--print', 'settings']));
+  // --context economy puts the plan's autoCompactWindow into that half; default leaves it out.
+  const profile = JSON.parse(python([path.join(SRC, 'scripts/resolve-profile.py'), PROFILE_NAME, '--src', SRC,
+    '--context', CONTEXT, '--print', 'settings']));
   if (TIER === 'max' && FABLE === 'no') {
     profile.availableModels = (profile.availableModels || []).filter((m) => !String(m).startsWith('fable'));
     if (isObj(profile.modelSettings)) delete profile.modelSettings['claude-fable-5-1'];
@@ -404,18 +422,26 @@ function claudeRender() {
   const fallbacks = Array.isArray(snippet.fallbackModel) ? snippet.fallbackModel : [snippet.fallbackModel];
   const FALLBACK = fallbacks.join(', then ');
   const EFFORT = String(snippet.effortLevel);
-  const COMPACT = Number(snippet.autoCompactWindow);
-  // Auto-compaction fires about 33k under the window; context-guard.py derives its
-  // thresholds from the same point. Claude Code caps autoCompactWindow at the model's
-  // own window, so print the number that matches the session this install configures.
+  // The plan's own window (riskrails.economy), written only with --context economy; in
+  // default the runtime compacts against the model's window. Auto-compaction fires about
+  // 33k under the window; context-guard.py derives its thresholds from the same point and
+  // holds a prompt back only when a window is configured. Claude Code caps
+  // autoCompactWindow at the model's own window, so print the number that matches the
+  // session this install configures.
+  const COMPACT = CONTEXT === 'economy' ? Number(snippet.autoCompactWindow) || 0 : 0;
   const MODEL_WINDOW = SESSION_MODEL.includes('[1m]') ? 1000000 : 200000;
-  const COMPACT_AT = Math.min(COMPACT, MODEL_WINDOW) - 33000;
-  const oneM = read(path.join(SRC, 'bin/claude-1m')).match(/^WINDOW="\$\{CLAUDE_1M_COMPACT_WINDOW:-([0-9]*)\}"$/m);
-  const ONE_M_AT = Number(oneM ? oneM[1] : 0) - 33000;
+  const fires = (window) => (COMPACT ? Math.min(COMPACT, window) : window) - 33000;
+  const COMPACT_AT = fires(MODEL_WINDOW);
+  const ONE_M_AT = fires(1000000);
+  const COMPACT_NOTE = COMPACT ? `\`autoCompactWindow\` ${COMPACT}` : 'the runtime default, `--context economy` sets a window';
   const ONE_M_FABLE = FABLE === 'yes' ? ' and `claude-1m fable` for Fable 5.1 [1m]' : '';
-  let ONE_M_RULE = `One \`autoCompactWindow\` of ${COMPACT} serves every model: Claude Code caps it at the model's own window, so this session compacts near ${COMPACT_AT} and a \`[1m]\` one near ${ONE_M_AT}, whether it was started with \`claude-1m\` (\`~/.claude/bin/claude-1m\`) for \`opus[1m]\`${ONE_M_FABLE} or switched to with \`/model\`. \`claude-1m\` pins the model at launch and \`CLAUDE_1M_COMPACT_WINDOW\` lowers the window for that one process; it is no longer what grants the large window. When a task inside an ordinary session needs one large-context read, say so and, once the user agrees, run \`claude-1m -p '<brief>'\` from Bash — its own process, only the answer comes back.`;
+  let ONE_M_RULE = COMPACT
+    ? `One \`autoCompactWindow\` of ${COMPACT} serves every model: Claude Code caps it at the model's own window, so this session compacts near ${COMPACT_AT} and a \`[1m]\` one near ${ONE_M_AT}, whether it was started with \`claude-1m\` (\`~/.claude/bin/claude-1m\`) for \`opus[1m]\`${ONE_M_FABLE} or switched to with \`/model\`. \`claude-1m\` pins the model at launch and \`CLAUDE_1M_COMPACT_WINDOW\` lowers the window for that one process; it is no longer what grants the large window. When a task inside an ordinary session needs one large-context read, say so and, once the user agrees, run \`claude-1m -p '<brief>'\` from Bash — its own process, only the answer comes back.`
+    : `Compaction is at the runtime default: each model compacts against its own window, so this session near ${COMPACT_AT} and a \`[1m]\` one near ${ONE_M_AT}, whether it was started with \`claude-1m\` (\`~/.claude/bin/claude-1m\`) for \`opus[1m]\`${ONE_M_FABLE} or switched to with \`/model\`. \`claude-1m\` pins the model at launch and \`CLAUDE_1M_COMPACT_WINDOW\` sets an earlier window for that one process. When a task inside an ordinary session needs one large-context read, say so and, once the user agrees, run \`claude-1m -p '<brief>'\` from Bash — its own process, only the answer comes back.`;
   if (MODEL_WINDOW > 200000) {
-    ONE_M_RULE = `\`autoCompactWindow\` ${COMPACT} applies uncapped to this 1M session, so it compacts near ${COMPACT_AT}; a 200k model picked with \`/model opus\` is capped at its own window and compacts near 167000. For a small task a 200k session is cheaper per turn — say so and let the user switch. \`claude-1m\` (\`~/.claude/bin/claude-1m\`) still pins the model at launch${ONE_M_FABLE}, and \`CLAUDE_1M_COMPACT_WINDOW\` lowers the window for that one process.`;
+    ONE_M_RULE = COMPACT
+      ? `\`autoCompactWindow\` ${COMPACT} applies uncapped to this 1M session, so it compacts near ${COMPACT_AT}; a 200k model picked with \`/model opus\` is capped at its own window and compacts near 167000. For a small task a 200k session is cheaper per turn — say so and let the user switch. \`claude-1m\` (\`~/.claude/bin/claude-1m\`) still pins the model at launch${ONE_M_FABLE}, and \`CLAUDE_1M_COMPACT_WINDOW\` lowers the window for that one process.`
+      : `Compaction is at the runtime default, so this 1M session compacts near ${COMPACT_AT} and context-guard only warns; a 200k model picked with \`/model opus\` compacts near 167000. For a small task a 200k session is cheaper per turn — say so and let the user switch. \`claude-1m\` (\`~/.claude/bin/claude-1m\`) still pins the model at launch${ONE_M_FABLE}, and \`CLAUDE_1M_COMPACT_WINDOW\` sets an earlier window for that one process.`;
   }
   const READ_LINES = String(snippet.env.CLAUDE_READ_MAX_LINES);
   const READ_BYTES = String(snippet.env.CLAUDE_READ_MAX_BYTES);
@@ -442,17 +468,17 @@ function claudeRender() {
       ARCHITECT_MODEL_LINE = 'model: fable[1m]';
       ARCHITECT_EFFORT = 'xhigh';
       EXPERT_ROW = '`fable[1m]` / `xhigh`, pinned on `architect`';
-      PLAN_SPECIFIC = `- Session model is ${SESSION_HUMAN} by default, compaction near ${COMPACT_AT} tokens (\`autoCompactWindow\` ${COMPACT}). A large context is not free: every turn re-reads it, so keep \`/clear\` between tasks. ${ONE_M_RULE} Fable 5.1 [1m] is pinned on \`architect\` (\`model: fable[1m]\`, \`xhigh\`) and is the session only when the user starts one with \`claude-1m fable\` — never pick it for a reader or a reviewer. \`max\` stays off.
+      PLAN_SPECIFIC = `- Session model is ${SESSION_HUMAN} by default, compaction near ${COMPACT_AT} tokens (${COMPACT_NOTE}). A large context is not free: every turn re-reads it, so keep \`/clear\` between tasks. ${ONE_M_RULE} Fable 5.1 [1m] is pinned on \`architect\` (\`model: fable[1m]\`, \`xhigh\`) and is the session only when the user starts one with \`claude-1m fable\` — never pick it for a reader or a reviewer. \`max\` stays off.
 - \`runtime-gate\` checks Fable at run time. \`fallbackModel\` covers an overload; after a rate-limit or model-not-found failure, and while the weekly limit is ${WEEKLY}% or more used, the gate sends every \`model: fable\` agent to Opus until the reset, and says so in the agent's context. If a Fable agent still returns such an error, re-run the same brief once with \`model: opus\` — an availability switch, not a downgrade. \`~/.claude/hooks/runtime-gate.py status\` shows the gate; \`clear\` re-enables Fable early.`;
     } else {
       ARCHITECT_MODEL_LINE = `# model: intentionally omitted — inherits the session model (${SESSION_HUMAN}, Fable disabled in this install)`;
       ARCHITECT_EFFORT = 'high';
       EXPERT_ROW = `the session model at \`${ARCHITECT_EFFORT}\` — \`architect\` inherits it`;
-      PLAN_SPECIFIC = `- Session model is ${SESSION_HUMAN} by default, compaction near ${COMPACT_AT} tokens (\`autoCompactWindow\` ${COMPACT}). ${ONE_M_RULE} Fable is disabled in this install (\`--fable no\`). Do not request \`model: fable\` anywhere. \`xhigh\` and \`max\` stay off.`;
+      PLAN_SPECIFIC = `- Session model is ${SESSION_HUMAN} by default, compaction near ${COMPACT_AT} tokens (${COMPACT_NOTE}). ${ONE_M_RULE} Fable is disabled in this install (\`--fable no\`). Do not request \`model: fable\` anywhere. \`xhigh\` and \`max\` stay off.`;
     }
     if (PLAN === 'balanced-max') {
       ARCHITECT_MODEL_LINE = '# model: intentionally omitted — inherits the session model (Opus 5.5; no Fable on BalancedMax)';
-      PLAN_SPECIFIC = `- BalancedMax: only the session runs the strong model. Session model is Opus 5.5 with the 200k window and compaction near ${COMPACT_AT} tokens (\`autoCompactWindow\` ${COMPACT}); it plans and implements. Agents keep their cheap tiers — readers (\`Explore\`, \`log-reader\`) on \`${tier('FAST', 'model')}\` / \`${tier('FAST', 'effort')}\`, judgement (\`ai-discovery\`) on \`${tier('BALANCED', 'model')}\`, \`ai-reviewer\` on \`${tier('STRONG', 'model')}\`, and \`architect\` inherits the session. \`opus[1m]\` is a per-task choice, never the default. ${ONE_M_RULE} Fable is off on this plan; never request \`model: fable\`. \`xhigh\` and \`max\` stay off.`;
+      PLAN_SPECIFIC = `- BalancedMax: only the session runs the strong model. Session model is Opus 5.5 with the 200k window and compaction near ${COMPACT_AT} tokens (${COMPACT_NOTE}); it plans and implements. Agents keep their cheap tiers — readers (\`Explore\`, \`log-reader\`) on \`${tier('FAST', 'model')}\` / \`${tier('FAST', 'effort')}\`, judgement (\`ai-discovery\`) on \`${tier('BALANCED', 'model')}\`, \`ai-reviewer\` on \`${tier('STRONG', 'model')}\`, and \`architect\` inherits the session. \`opus[1m]\` is a per-task choice, never the default. ${ONE_M_RULE} Fable is off on this plan; never request \`model: fable\`. \`xhigh\` and \`max\` stay off.`;
     }
     EFFORT_RULE = 'Raise to `high` for architecture, root-cause analysis and adversarial verification, and say that you are raising it; readers stay at `low`.';
   }
@@ -467,7 +493,10 @@ function claudeRender() {
   const vars = {
     PLAN: PLAN_LABEL, PLAN_LABEL, SESSION_MODEL: SESSION_HUMAN, FALLBACK_MODEL: FALLBACK_HUMAN,
     DEFAULT_EFFORT: EFFORT, COMPACT_WINDOW: spaced(COMPACT_AT),
-    CONTEXT_WARN: `${Math.trunc(COMPACT_AT * 80 / 100000)}k`, CONTEXT_BLOCK: `${Math.trunc(COMPACT_AT * 120 / 100000)}k`,
+    CONTEXT_WARN: `${Math.trunc(COMPACT_AT * 80 / 100000)}k`,
+    CONTEXT_BLOCK: COMPACT
+      ? `and from ${Math.trunc(COMPACT_AT * 120 / 100000)}k the prompt is held back once — sending it again goes through`
+      : 'and the prompt is never held back (only `--context economy` sets a block threshold)',
     READ_LINES, PLAN_SPECIFIC_ROUTING: PLAN_SPECIFIC, EFFORT_RULE, EXPERT_EFFORT, EXPERT_MODEL_LINE, EXPERT_ROW,
     ARCHITECT_MODEL_LINE, ARCHITECT_EFFORT,
     FAST_MODEL: tier('FAST', 'model'), FAST_EFFORT: tier('FAST', 'effort'),
@@ -524,8 +553,11 @@ function shSplit(s) {                                            // shlex.split,
   return words;
 }
 
+// The wrapper is `<PREFIX> [--context] [--then '<the user's command>']`; --context
+// (--statusline-context yes) adds a line with the model and the context use.
 function statuslineGate(file, gate, mode) {
   const PREFIX = '"$HOME/.claude/hooks/runtime-gate.py" statusline';
+  const WANT = STATUSLINE_CONTEXT === 'yes' ? `${PREFIX} --context` : PREFIX;
   const OLD_PREFIX = '"$HOME/.claude/hooks/fable-gate.py" statusline';
   let settings = {};
   if (exists(file)) {
@@ -538,23 +570,35 @@ function statuslineGate(file, gate, mode) {
     line.command = PREFIX + cmd.slice(OLD_PREFIX.length);
     ours = true; gate = 'moved';
   }
+  // What follows the prefix and an optional --context: the user's --then, byte for byte.
+  const tail = () => line.command.slice(PREFIX.length).trim().replace(/^--context(\s+|$)/, '');
+  const shown = STATUSLINE_CONTEXT === 'yes' ? ' with the model and the context use' : '';
   let action = null;
   if (gate === 'moved') {
+    const rest = tail();
+    line.command = rest ? `${WANT} ${rest}` : WANT;
     action = 'moved the fable-gate statusline wrapper to runtime-gate (your command is unchanged)';
   } else if (gate === 'on') {
-    if (ours) return ['statusline: already records the quota'];
-    if (line === undefined || line === null) {
-      settings.statusLine = { type: 'command', command: PREFIX };
-      action = 'added a silent statusline that records the quota (and the Fable weekly limit)';
+    if (ours) {
+      const rest = tail();
+      const want = rest ? `${WANT} ${rest}` : WANT;
+      if (want === cmd) return ['statusline: already records the quota'];
+      line.command = want;
+      action = STATUSLINE_CONTEXT === 'yes'
+        ? 'added the model and the context use to the statusline wrapper (your command is unchanged)'
+        : 'removed the model and context line from the statusline wrapper (your command is unchanged)';
+    } else if (line === undefined || line === null) {
+      settings.statusLine = { type: 'command', command: WANT };
+      action = `added a statusline that records the quota (and the Fable weekly limit)${shown}`;
     } else if (isObj(line) && line.type === 'command' && typeof cmd === 'string' && cmd.trim()) {
-      line.command = `${PREFIX} --then ${shQuote(cmd)}`;
-      action = 'wrapped your statusline command with the quota check (its output is unchanged)';
+      line.command = `${WANT} --then ${shQuote(cmd)}`;
+      action = `wrapped your statusline command with the quota check${shown} (its output is unchanged)`;
     } else {
       return ['statusline: not a command statusline; the weekly-limit check is not wired'];
     }
   } else {
     if (!ours) return [];
-    const rest = cmd.slice(PREFIX.length).trim();
+    const rest = tail();
     if (rest.startsWith('--then')) {
       const parts = shSplit(rest);
       line.command = parts.length > 1 ? parts[1] : '';
@@ -579,12 +623,26 @@ const claudeHookFiles = () => [...glob(path.join(SRC, 'hooks'), '.sh'), ...glob(
   .filter((f) => !path.basename(f).startsWith('codex-'));
 const skillsLine = (plugin) => out(`   skills:  ${ls(path.join(SRC, 'skills')).filter((n) => isDir(path.join(SRC, 'skills', n))).join(',')}${plugin ? ' (without SKILL.md: the plugin loads them)' : ''}`);
 
+// Without --context economy, an autoCompactWindow equal to a shipped plan's economy window
+// (800000 Max, 300000 Pro — the one an earlier install wrote, whichever plan it was for)
+// goes; any other value is the user's own and stays. Returns the value to remove, or 0.
+function ownCompactWindow(doc) {
+  if (CONTEXT === 'economy' || !isObj(doc)) return 0;
+  const shipped = glob(path.join(SRC, 'profiles'), '.json').map((f) => {
+    try { return Number(((readJSON(f).riskrails || {}).economy || {}).autoCompactWindow) || 0; } catch (e) { return 0; }
+  });
+  return shipped.includes(doc.autoCompactWindow) ? doc.autoCompactWindow : 0;
+}
+
 function claudeDryRun() {
   out(`== claude: plan=${PLAN} (${C.PLAN_LABEL}, ${C.TIER} profile) fable=${FABLE} fable-gate=${C.GATE} runtime-gate=on (dry run, nothing written)`);
   out(`== claude: target directory ${CLAUDE_DIR}`);
   for (const l of statuslineGate(path.join(CLAUDE_DIR, 'settings.json'), 'on', 'dry')) out('== ' + l);
   out(`== settings snippet (merged into ${CLAUDE_DIR}/settings.json):`);
   out(pretty(C.snippet));
+  let current = {};
+  try { current = readJSON(path.join(CLAUDE_DIR, 'settings.json')); } catch (e) { /* nothing installed yet */ }
+  if (ownCompactWindow(current)) out(`== would remove autoCompactWindow ${current.autoCompactWindow} (economy off)`);
   out('== agents/architect.md (rendered head):');
   out(read(path.join(TMP, 'agents/architect.md')).split('\n').slice(0, 10).join('\n'));
   out('== CLAUDE.md managed block:');
@@ -1045,6 +1103,11 @@ function claudeApply() {
     if (dropPluginDuplicates(doc, keys)) out('removed: the hook entries the riskrails plugin now runs');
     if (isObj(doc.env) && doc.env.CLAUDE_CODE_SUBAGENT_MODEL === 'sonnet') delete doc.env.CLAUDE_CODE_SUBAGENT_MODEL;
     doc = mergeHooks(deepMerge(doc, snippet), newHooks, true);
+    const own = ownCompactWindow(doc);
+    if (own) {
+      delete doc.autoCompactWindow;
+      out(`removed: autoCompactWindow ${own} (economy off)`);
+    }
     writeJSONFile(SETTINGS, doc);
   }
   out('merged: settings.json');
@@ -1119,11 +1182,16 @@ function claudeSummary() {
     `  session model   ${C.SESSION_MODEL} (${C.SESSION_HUMAN}), effort ${C.EFFORT}`,
     `  fallback        ${C.FALLBACK}`,
     `  EXPERT tier     architect on ${expert} at effort ${C.ARCHITECT_EFFORT}`,
-    `  compaction      near ${C.COMPACT_AT} tokens on this ${Math.trunc(C.MODEL_WINDOW / 1000)}k session (autoCompactWindow ${C.COMPACT},`,
-    "                  capped at the model's window); context-guard warns from",
-    `                  ${Math.trunc(C.COMPACT_AT * 80 / 100)} and holds a prompt back once from ${Math.trunc(C.COMPACT_AT * 120 / 100)}`,
+    ...(C.COMPACT ? [
+      `  compaction      near ${C.COMPACT_AT} tokens on this ${Math.trunc(C.MODEL_WINDOW / 1000)}k session (autoCompactWindow ${C.COMPACT},`,
+      "                  capped at the model's window, --context economy); context-guard warns from",
+      `                  ${Math.trunc(C.COMPACT_AT * 80 / 100)} and holds a prompt back once from ${Math.trunc(C.COMPACT_AT * 120 / 100)}`,
+    ] : [
+      `  compaction      the runtime default: near ${C.COMPACT_AT} tokens on this ${Math.trunc(C.MODEL_WINDOW / 1000)}k session;`,
+      `                  context-guard warns from ${Math.trunc(C.COMPACT_AT * 80 / 100)} and never holds a prompt back (economy only)`,
+    ]),
     C.TIER === 'max'
-      ? `  large context   claude-1m${FABLE === 'yes' ? ' [opus|fable]' : ''} starts one session on opus[1m]${FABLE === 'yes' ? ' or fable[1m] (Fable 5.1)' : ''} that compacts near ${C.ONE_M_AT}\n                  (the same autoCompactWindow, uncapped on a 1M model)`
+      ? `  large context   claude-1m${FABLE === 'yes' ? ' [opus|fable]' : ''} starts one session on opus[1m]${FABLE === 'yes' ? ' or fable[1m] (Fable 5.1)' : ''} that compacts near ${C.ONE_M_AT}\n                  (${C.COMPACT ? 'the same autoCompactWindow, uncapped on a 1M model' : 'the runtime default'})`
       : '',
     `  read guard      an unbounded Read is refused above ${C.READ_LINES} lines / ${C.READ_BYTES} bytes`,
     `  agents          ${agentNames(' ')}`,
@@ -1210,14 +1278,15 @@ function codexRender() {
 }
 
 // The guard scripts Codex can use. cap-large-read.py is absent: Codex has no hookable Read
-// tool. context-guard.py serves both runtimes: it reads its own location to know which.
-const codexHookFiles = () => ['ai-guard.py', 'runtime-gate.py', 'context-guard.py'].map((n) => path.join(SRC, 'hooks', n));
+// tool. context-guard.py serves both runtimes: it reads its own location to know which;
+// dialog-gate.py reads the payload's envelope (R36.19).
+const codexHookFiles = () => ['ai-guard.py', 'runtime-gate.py', 'context-guard.py', 'dialog-gate.py', 'update_notice.py'].map((n) => path.join(SRC, 'hooks', n));
 
 function codexDryRun() {
   out(`== codex: plan=${CODEX_PLAN} (${X.label}) session ${X.s(X.P.session.model)} at ${X.s(X.P.session.model_reasoning_effort)} (dry run, nothing written)`);
   out(`== codex: target directory ${CODEX_DIR}`);
   const merged = python([path.join(SRC, 'scripts/merge-codex-config.py'), path.join(CODEX_DIR, 'config.toml'),
-    '--profile', X.profileFile, '--dry-run'], { allowFail: true });
+    '--profile', X.profileFile, '--status-context', STATUSLINE_CONTEXT, '--dry-run'], { allowFail: true });
   for (const l of merged.replace(/\n$/, '').split('\n')) if (merged) out('== ' + l);
   out('== AGENTS.md managed block:');
   fs.writeSync(1, read(path.join(TMP, 'AGENTS.block.md')));
@@ -1274,7 +1343,9 @@ function codexApply() {
   // codex-model-gate entries from before WP5 and runtime-gate ones from an earlier run go
   // first, so the merge adds exactly one gate per event. Codex runs only hooks the user has
   // reviewed (config.toml keeps a trusted_hash per entry): a changed entry is skipped until
-  // it is reviewed once in /hooks.
+  // it is reviewed once in /hooks. A group whose commands are exactly a new group's is
+  // replaced by it, as on Claude, so a reinstall carries a widened matcher (R36 7d2); an
+  // unchanged group is written back as it was and keeps its trust.
   const HOOKS = path.join(CODEX_DIR, 'hooks.json');
   if (isFile(HOOKS)) backupFile(HOOKS, CODEX_DIR); else fs.writeFileSync(HOOKS, '{}\n');
   let hadShim = false, hadGuardShims = false;
@@ -1286,7 +1357,11 @@ function codexApply() {
     dropHooks(doc, SHIM_RE);
     const keys = pluginHookKeys(plugin, 'codex-hooks.json');
     if (dropPluginDuplicates(doc, keys)) out('removed: the hook entries the riskrails plugin now runs');
-    writeJSONFile(HOOKS, mergeHooks(doc, withoutPluginHooks(readJSON(path.join(SRC, 'codex/hooks.json')).hooks, keys), false));
+    const fresh = withoutPluginHooks(readJSON(path.join(SRC, 'codex/hooks.json')).hooks, keys);
+    const changed = Object.entries(fresh).some(([ev, entries]) => ((isObj(doc.hooks) && doc.hooks[ev]) || []).some(
+      (old) => entries.some((e) => sameList(commands(e), commands(old)) && !sameList(e, old))));
+    writeJSONFile(HOOKS, mergeHooks(doc, fresh, true));
+    if (changed) out('changed: riskrails hook entries in hooks.json — review them once in /hooks, or Codex skips them');
   }
   out('merged: hooks.json');
   if (hadShim) out('replaced: codex-model-gate.py hooks with runtime-gate.py — review the changed gate entries once in /hooks, or Codex skips them');
@@ -1300,7 +1375,8 @@ function codexApply() {
   const config = path.join(CODEX_DIR, 'config.toml'), before = path.join(TMP, 'config.toml.before');
   rmrf(before);
   if (exists(config) && fs.statSync(config).size > 0) fs.copyFileSync(fs.realpathSync(config), before);
-  python([path.join(SRC, 'scripts/merge-codex-config.py'), config, '--profile', X.profileFile, '--no-backup'], { capture: false });
+  python([path.join(SRC, 'scripts/merge-codex-config.py'), config, '--profile', X.profileFile,
+    '--status-context', STATUSLINE_CONTEXT, '--no-backup'], { capture: false });
   if (exists(before) && fs.statSync(before).size > 0 && !sameFile(before, config)) backupFile(config, CODEX_DIR, before);
 
   // -------------------------------------------------------------- 6. AGENTS.md

package/codex/hooks.json

@@ -3,13 +3,13 @@
   "hooks": {
     "PreToolUse": [
       {
-        "matcher": "Bash|apply_patch|Edit|Write",
+        "matcher": ".*",
         "hooks": [
           {
             "type": "command",
             "command": "python3 -I -S \"$HOME/.codex/hooks/ai-guard.py\"",
             "timeout": 15,
-            "statusMessage": "Checking git, paths and scope"
+            "statusMessage": "Checking git, paths, scope and open decisions"
           }
         ]
       },
@@ -36,6 +36,17 @@
             "statusMessage": "Recording expert-model availability"
           }
         ]
+      },
+      {
+        "matcher": "^request_user_input$",
+        "hooks": [
+          {
+            "type": "command",
+            "command": "python3 -I -S \"$HOME/.codex/hooks/dialog-gate.py\"",
+            "timeout": 5,
+            "statusMessage": "Recording the dialog's answer"
+          }
+        ]
       }
     ],
     "SubagentStart": [
@@ -98,6 +109,18 @@
           }
         ]
       }
+    ],
+    "Stop": [
+      {
+        "hooks": [
+          {
+            "type": "command",
+            "command": "python3 -I -S \"$HOME/.codex/hooks/dialog-gate.py\"",
+            "timeout": 5,
+            "statusMessage": "Checking for an open decision"
+          }
+        ]
+      }
     ]
   }
 }

package/hooks/AGENTS.md

@@ -1,6 +1,6 @@
-<!-- claude-agentic:rule:hooks:start -->
+<!-- riskrails:rule:hooks:start -->
 # Hooks rules
 - Weigh a change by what it does to a user project's decisions, never by the hook being a process every call runs through (constitution C6). The mode is what W gives (`state.py weight`); the rows below set the behaviour axis.
 - behaviour 0: no guard decision moves, golden byte-identical. behaviour 1: adds a deny or changes a deny's text, golden re-recorded. behaviour 2: allows what was denied or weakens a refusal — declare it, `--declare behaviour=2:"<the effect>"`. Start such a task with `start --mode full --by <name>`: its weight lands in guarded, and these effects keep a STRONG review and the gate.
 - The guards defend against an agent's mistakes, not a constructed command: such a finding is accepted in `known-risks.md` under the threat model in `.ai/policies/safety.md`.
-<!-- claude-agentic:rule:hooks:end -->
+<!-- riskrails:rule:hooks:end -->

package/hooks/CLAUDE.md

@@ -1,6 +1,6 @@
-<!-- claude-agentic:rule:hooks:start -->
+<!-- riskrails:rule:hooks:start -->
 # Hooks rules
 - Weigh a change by what it does to a user project's decisions, never by the hook being a process every call runs through (constitution C6). The mode is what W gives (`state.py weight`); the rows below set the behaviour axis.
 - behaviour 0: no guard decision moves, golden byte-identical. behaviour 1: adds a deny or changes a deny's text, golden re-recorded. behaviour 2: allows what was denied or weakens a refusal — declare it, `--declare behaviour=2:"<the effect>"`. Start such a task with `start --mode full --by <name>`: its weight lands in guarded, and these effects keep a STRONG review and the gate.
 - The guards defend against an agent's mistakes, not a constructed command: such a finding is accepted in `known-risks.md` under the threat model in `.ai/policies/safety.md`.
-<!-- claude-agentic:rule:hooks:end -->
+<!-- riskrails:rule:hooks:end -->

package/hooks/ai-guard.py

@@ -3,8 +3,12 @@
 
 Reads the hook payload from stdin and either exits 0 silently (allow) or prints
 the deny object and exits 0, the contract of every guard. The checks are the
-three shell guards this replaces, in the order a runtime ran them:
+open-decision gate, then the three shell guards this replaces, in the order a
+runtime ran them:
 
+  decision  the gate while a dialog decision is open, on every tool
+            (guard/decision.py): deny all but the dialog, the picked command
+            and `state.py decision show|settle|fallback`
   git    git and deployment safety, on Bash (guard/git.py)
   paths  sensitive paths, control files, the runtime lock, dependency
          instruction files (guard/paths.py)
@@ -12,20 +16,24 @@ three shell guards this replaces, in the order a runtime ran them:
 
 `--only <check>` runs one of them; that is what each hooks/ai-*-guard.sh shim
 passes, so a registration made for the shell guards keeps its meaning. With no
-flag all three run and the first refusal wins.
+flag all of them run and the first refusal wins.
 
 Fail-open: anything unexpected — a payload that is not JSON, a missing file,
 an exception — allows, with no output. A guard is defence-in-depth against an
 agent's mistakes, not a security boundary, and must never make a tool unusable.
+Two exceptions, both with the dialog on (R36): the git check's consent rule
+denies a commit or push when the consent ledger cannot be read (R36.9), and
+state.py's own approve refuses without a pick or a terminal (R36.10).
 Run as `python3 -I -S`: no site packages, no environment-driven imports.
 """
 import os
 import sys
 
-CHECKS = ("git", "paths", "scope")
+CHECKS = ("decision", "git", "paths", "scope")
 # The tools each check reads; any other tool is allowed by its first line, so
-# the module is not even imported for it.
+# the module is not even imported for it. None: every tool.
 TOOLS = {
+    "decision": None,
     "git": ("Bash",),
     "paths": ("Read", "Edit", "Write", "MultiEdit", "NotebookEdit", "Bash"),
     "scope": ("Edit", "Write", "MultiEdit", "NotebookEdit"),
@@ -52,16 +60,28 @@ def main(argv):
             return 0
         ctx = Context(payload, loc, pwd, common.bytes_b(os.fsencode(hook_dir)))
         for name in (only,) if only else CHECKS:
-            if payload.tool not in TOOLS[name]:
+            if TOOLS[name] is not None and payload.tool not in TOOLS[name]:
                 continue
-            module = __import__("guard." + name, fromlist=["check"])
             # Each shell guard was its own process with its own SECONDS: the
-            # first check's clock started with the process, a later one's now.
-            ctx.clock = common.Clock(common.START if name == ((only,) if only else CHECKS)[0] else None)
+            # first shell guard's clock started with the process, a later one's
+            # now. The decision check, new, does not move that.
+            ctx.clock = common.Clock(common.START if name == (only or "git") else None)
             try:
+                module = __import__("guard." + name, fromlist=["check"])
                 module.check(ctx)
             except common.Allow:
                 continue
+            except Exception as exc:        # pylint: disable=broad-exception-caught
+                # The decision gate fails open on its own (R36.12): a missing or
+                # broken module — a half-done install — must not end the run
+                # before git, paths and scope.
+                if name != "decision" or isinstance(exc, common.Deny):
+                    # A git pick the gate spent on this call is gone even
+                    # though a later rule refuses the command (review focus 1).
+                    if isinstance(exc, common.Deny) and name != "decision" and ctx.consent:
+                        from guard import dialog    # pylint: disable=import-outside-toplevel
+                        exc.reason += common.text_to_b(dialog.used_note(ctx.consent))  # pylint: disable=no-member  # exc is a common.Deny by the isinstance above
+                    raise
     except Exception as exc:                # pylint: disable=broad-exception-caught
         common = sys.modules.get("guard.common")
         if common is not None and isinstance(exc, common.Deny):
@@ -86,6 +106,7 @@ class Context:                              # pylint: disable=too-few-public-met
         self.pwd = pwd
         self.hook_dir = hook_dir
         self.clock = common.Clock()
+        self.consent = None                 # the git pick the decision gate spent on this call
 
 
 if __name__ == "__main__":

package/hooks/ai-path-guard-defaults.json

@@ -1,5 +1,5 @@
 {
-  "_comment": "Shipped defaults for ai-path-guard. Do not edit this file; a project overrides it in .ai/policies/path-guard.json (patterns are unioned, allow wins over every other list). Patterns are POSIX extended regular expressions matched against the absolute path. deny_patterns are secrets: refused for read and write. protected_config_patterns are always on and refuse writes: the task's state and journal, task.md, and the guards' own configuration, engine and state.py under .claude/ or .codex/, in a project or in the user's home, and the riskrails plugin's cache folder, which carries the same code on the plugin route. A project's dependency_instruction_patterns, from before 3.4, are read as deny_patterns. task_protected_patterns are on only while a task is in flight (.ai/state/state.json, or else current.json, exists and has not reached \"done\"): the runtime's settings, Claude's record of installed plugins and the pipeline's policies, so a run cannot change the rules it is being judged by. Reading anything but a secret is allowed.",
+  "_comment": "Shipped defaults for ai-path-guard. Do not edit this file; a project overrides it in .ai/policies/path-guard.json (patterns are unioned, allow wins over every other list). Patterns are POSIX extended regular expressions matched against the absolute path. deny_patterns are secrets: refused for read and write. protected_config_patterns are always on and refuse writes: the task's state and journal, task.md, the compact record (.ai/memory/, .ai/local/memory/), and the guards' own configuration, engine and state.py under .claude/ or .codex/, in a project or in the user's home, and the riskrails plugin's cache folder, which carries the same code on the plugin route. A project's dependency_instruction_patterns, from before 3.4, are read as deny_patterns. task_protected_patterns are on only while a task is in flight (.ai/state/state.json, or else current.json, exists and has not reached \"done\"): the runtime's settings, Claude's record of installed plugins and the pipeline's policies, so a run cannot change the rules it is being judged by. Reading anything but a secret is allowed.",
   "deny_patterns": [
     "(^|/)\\.env$",
     "(^|/)\\.env\\.(local|prod|production|staging|live)$",
@@ -29,6 +29,8 @@
     "(^|/)\\.ai/reports/[^/]+/events\\.jsonl$",
     "(^|/)\\.ai/reports/[^/]+/(adopt|migration)\\.json$",
     "(^|/)\\.ai/policies/[^/]*\\.json$",
+    "(^|/)\\.ai/memory/",
+    "(^|/)\\.ai/local/memory/",
     "(^|/)\\.claude/hooks/ai-[^/]*$",
     "/\\.claude/hooks/ai-[^/]*$",
     "(^|/)\\.codex/hooks/ai-[^/]*$",